HSTS does not include subdomains
HSTS is set for this host only. Subdomains are not covered.
Why it matters
A subdomain can still be reached over plaintext HTTP.
What to do
Add includeSubDomains after you confirm every subdomain supports HTTPS.
Reference
HSTS max-age and directive syntax are defined by RFC 6797.